feat(bcn01-lab): add 1:1 NAT support and import Synology rule

Add meraki_appliance_firewall_one_to_one_nat_rules resource to the
meraki-site module and codify the existing Synology NAT rule found in
BCN01-LAB Dashboard (57.133.120.190 → 10.2.56.3 via internet2).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/meraki-site/variables.tf

@@ -213,6 +213,23 @@ variable "mx_warm_spare" {
   description = "Configuración Warm Spare (HA) del MX. El serial del spare se resuelve por nombre."
 }
 
+# Reglas NAT 1:1 del firewall MX
+variable "one_to_one_nat_rules" {
+  type = list(object({
+    name      = string
+    public_ip = string
+    lan_ip    = string
+    uplink    = optional(string, "internet1")
+    allowed_inbound = optional(list(object({
+      protocol          = optional(string, "any")
+      destination_ports = optional(list(string), ["Any"])
+      allowed_ips       = list(string)
+    })), [])
+  }))
+  default     = []
+  description = "Reglas NAT 1:1 del MX. Mapean una IP pública a una IP interna con control de tráfico entrante."
+}
+
 # Puertos del firewall MX
 variable "appliance_ports" {
   type = list(object({